Set LDAP User Group Mapping Rules
If you have configured different User Groups and Access Groups to provide these User Groups with least privilege access to authorized resources, you can easily enforce these access restrictions based on any appropriate user information being maintained in your LDAP Server by using LDAP User Group mapping rules.
To use attribute-based access control based on the department, you created different CloudConnexa User Groups and Applications and have configured Access Groups restricting each User Group to access only applications authorized for that department. For example, User Group HR can access App A, X, and Y, and User Group Finance can access App B and Z. Now what is left to do is to get the department information when a user logs in with LDAP and assign the user to the correct CloudConnexa User Group. LDAP User Group Mapping Rules allow you to map the values of a LDAP attribute selected to represent the Group to specific CloudConnexa User Groups.
Once you have mapped the attribute being sent across by the IdP to UserGroup in the Attribute Mapping step(refer to Private LDAP), add a LDAP User Group Mapping rule by following the steps below:
Sign in to your WPC's Administration portal by entering your Cloud ID in a web browser (for example,
company_name.openvpn.com).Navigate to Settings > User Authentication.
Click Edit, which is located in the top right corner.
Click User Group Mapping in the Private LDAP section.
Check that the User Group Sync from LDAP switch to ON.
Click Add Rule.
Enter the value(s) set in the LDAP attribute and select one of the CloudConnexa User Groups from the drop-down it should map to. Provide a Priority to the rule, with 1 being the highest.
Click Add Rule
Click Cancel to exit.
Assignment of Primary and Secondary User Groups with LDAP or SAML Authentication
The User Group Mapping feature allows automatic assignment of CloudConnexa User Groups based on identity attributes received from an external Identity Provider (IdP), such as SAML or LDAP. This Group Mapping has been revised to support Primary and Secondary User Groups through IdP-based mapping.
The User Groups Mapping Rules have a Processing Order to reflect the sequential nature of rule evaluation. Lower numbers (e.g., "1") mean higher priority. The first matching rule defines the User's Primary User Group. All subsequent matching rules define Secondary User Groups (max 20) for the User.
Edit a User Group Mapping Rule
To edit a User Group Mapping Rule, follow the steps below:
Sign in to your WPC's Administration portal by entering your Cloud ID in a web browser (for example,
company_name.openvpn.com).Navigate to Settings > User Authentication.
Click Edit, which is located in the top right corner.
Click User Group Mapping in the Private LDAP section.
The list of rules will be shown in the User Group Mapping Rules table with the Edit
and the Delete 
icons for each rule record. Each rule record will also have Decrement 
and Increment 
icons.Click the Edit icon next to the rule record that needs to be changed.
Make the required changes.
Click Update Rule.
Click Cancel to exit.
Change the priority of a User Group Mapping Rule
If the LDAP provided value matches with multiple rules, the one with the highest priority will be used to map the User to the CloudConnexa User Group. If the value does not match with any of the mapping rules, the User will be mapped to the CloudConnexa User Group configured in the Unmapped LDAP User Groups section.
To change the priority of a rule, you can edit it and change the priority value, or you can use the Decrement and Increment icons by following the steps below:
Sign in to your WPC's Administration portal by entering your Cloud ID in a web browser (for example,
company_name.openvpn.com).Navigate to Settings > User Authentication.
Click Edit, which is located in the top right corner.
Click User Group Mapping in the Private LDAP section.
The list of rules will be shown in the User Group Mapping Rules table with the Edit
and the Delete icons for each rule record. Each rule record will also have Decrement and Increment icons.Click the Increment/Decrement icons next to the rules to arrange the rules by the needed priority in the table. The priorities of the affected rules are automatically updated.
Click Cancel to exit.
Delete a User Group Mapping Rule
To delete a User Group mapping rule, follow the steps below:
Sign in to your WPC's Administration portal by entering your Cloud ID in a web browser (for example,
company_name.openvpn.com).Navigate to Settings > User Authentication.
Click Edit, which is located in the top right corner.
Click User Group Mapping in the Private LDAP section.
The list of rules will be shown in the User Group Mapping Rules table with the Edit
and the Delete icons for each rule record. Each rule record will also have Decrement and Increment icons.Click the Delete icon next to the rule record that needs to be deleted.
Click Delete in the confirmation dialog box.
Click Cancel to exit.